felhom.eu/REPORT-day4-2026-10-09.md

REPORT — 2026-10-09: the kernel night read back, the release, the ep0-copy job, the live proofs

Operator present for the hub deploy (05:22Z) and the ep0-copy job (05:24–05:33Z). Architecture read: 07 §6.1 (backups), 11 §5.11 (the kernel lane), 09 §3 decisions 172, 181, 185–193.

Part table

Part	Result
Kernel night 8→9 read-back	demo-felhom: told 7.0.14-22, staged 04:44:42, restart 04:44:46, healthy 39 s after the agent, default now 7.0.14-22; apps down ~70 s (04:44:46 → 04:45:55). demo-hp: no kernel — the Proxmox step was refused R6 (proxmox-secure-boot-support pulled shim-signed-common), so the kernel step was skipped; still 7.0.14-20. „Approve kernel set": not shown (demo-hp has not booted the new kernel). One false backup alarm: demo-felhom „host tier: newest backup is 48h old" at 05:00 local — the backup ran 04:40; the restart emptied the agent's in-memory list (two nights running).
Two agent fixes (found in the read-back)	The host report adds the saved last success per tier (R-894's file); the Secure Boot meta-package joins the boot-chain lane. Both red-proved. Live: demo-felhom's report now carries the 02:40Z backup after a restart.
Release	agent 0.154.0 (db25b46, sha 36a54ad2…, bundle 93487989…), controller 0.304.0 (d7bfdcc), hub 0.144.0 (8dbdac5f, deployed 702e19ee). One release per repo.
Delivery (before 20:00)	demo-hp, demo-felhom, Tester 1: agent 0.154.0 (signed agent_update, 07:16–07:18 local), bundle (68/68 capability probe each), controller 0.304.0 (floors set 07:05 local, MinAgent 0.131.0). Tester 2 not touched. Global floor not touched. Agent NOT vouched for fresh installs (the vouch also needs a golden ≥ the fleet's controller; no golden today).
Hub deploy	Synced/Healthy at 702e19ee, pod image 0.144.0, log „felhom-hub 0.144.0 starting" (operator present).
D9 ep0-copy job	Installed with the operator present: new local PBS key root@pam!ep0-copy-gc (DatastoreAdmin on /datastore/ep0-copy only), three root-only files, never printed. First dry run found a parser defect (ep0 answers {"data": [...]}; the job read none of the customers) — the mass-absence guard stopped it, nothing recorded or deleted. Fixed, red-proved, pushed, reinstalled; dry run 5 of 5; timer on; first real run 08:00 local: 5 of 5, deleted 0.
D1 hub buttons	Proven on Tester 1 (operator's choice: 9202 has no hub): run_job fill-watch and offsite_backup_now both „done" on the host page; box log controls. Countdown buttons not proven (no countdown exists).
D2 box off	Proven on Tester 1: whole VM off → „last connected" at +114 s, tick open at 6 min, ingress log control. A stopped guest alone is restarted by the agent in 36 s.
D3 health mail + dashboard	Proven: household mail (Gmail) has no { and has the dashboard line; operator mail keeps the details; 9202's banners English/Hungarian by language.
D4 sign-in survives restart	Proven on 9202, including the password-change revocation.
D6 Cloudflare keys	Done later with the operator present: the hub's own check run read-only against all 4 stored keys — all PASS (one zone, their own domain); a fake key is refused. A same-key re-save would not have checked anything (the edit path checks only a new key or domain), so the check ran outside the save.
D7, D8	Not run: D7 needs a window (Tester 1's next ~2026-10-12); D8 needs a scratch off-site repo.

Open-items list: 141 when the register work started, 135 after. Opened 0, closed 6 (R-279, R-30, R-79, R-35, R-901, R-138). The three small findings (false backup alarm, Secure Boot meta-package, ep0 job parser) were fixed in the session, not filed.

What changed on the boxes during the proofs (all put back)

• Tester 1: the guest stopped once (36 s, restarted by the agent); the whole VM shut down 05:53–05:58Z; filebrowser stopped twice (~5 min each); the household mail address set to the catch-all for one mail, then cleared (empty address + no events; the hub keeps the old address by its no-clobber guard, with no events, so no mail goes out).
• 9202: controller image 0.303.0 → 0.304.0 by hand; the password changed and set back; language en and back to hu.
• DooPlex: /etc/felhom/ep0-copy-gc/ (3 root-only files), /usr/local/sbin/felhom-ep0-copy-gc, the service + timer, one PBS token and its ACL. No Docker cleanup, no reboot.

Other session

A parallel session had an unstaged deletion of REPORT-facebook-cover-r919.md in the shared clone; an autostash met its newer commit. I put the working tree back to exactly its state (the file deleted, unstaged) and dropped the stash.

Instruction-file edits

None. A stale fact was corrected in documentation/operations/nodes.md (not an instruction file): Tester 1 SSH by key from DooPlex now works (root@192.168.0.154); before it said the key was not authorized (2026-10-06).

Evidence: documentation/audits/kernel-night-2026-10-08/, documentation/audits/release-2026-10-09/.